X-Recipient: archive-cygwin AT delorie DOT com
X-Spam-Check-By: sourceware.org
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Transfer-Encoding: 7bit
Message-Id: <DDD65EF5-1C72-4986-9B85-CE867B0AAE4F@jessies.org>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
To: cygwin AT cygwin DOT com
From: Elliott Hughes <enh AT jessies DOT org>
Subject: 1.5.24-2: zero-length write() and ioctl() on fd -1 cause crashes
Date: Tue, 18 Sep 2007 11:54:20 -0700
X-Mailer: Apple Mail (2.752.2)
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

http://software.jessies.org/terminator/ uses Cygwin to provide  
Windows support, and it's been most useful. i just thought i'd  
mention a couple of things that caused crashes in cygwin1.dll  
1.5.24-2 where that might not have been Cygwin's intent (in both  
cases the application's skating on thin ice anyway).

first, if i do a zero-byte write(2) to a pty, i get a crash. POSIX  
says the behavior in that situation is undefined. i haven't tested  
with a regular file (where POSIX explicitly says that "write() will  
return 0 and have no other results").

second, if i try to set the window size on fd -1, i get a crash:

     int fd = -1;
     struct winsize size;
     // set size.ws_col, size.ws_row, size.ws_xpixel, and  
size.ws_ypixel...
     if (ioctl(fd, TIOCSWINSZ, &size) < 0) {

my interpretation of POSIX is that i should get return value -1 and  
errno set to EBADF in that case. i haven't tested with other invalid  
file descriptors or other requests.

i haven't tested earlier versions of cygwin1.dll.

strangely, a quick look at the Cygwin source suggests that these  
cases should be taken care of. "ioctl.cc"'s ioctl starts with a  
cygheap_fdget, and check_iovec would appear to take care of the 0- 
byte write case for write(2).

let me know if you'd like me to investigate further. i don't have a  
Windows machine myself, or i'd have done some non-source poking about  
already. [i'm also not a subscriber to this list, so don't forget to  
"reply all".]

  --elliott


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/